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UNITED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, D.C. 




IN RE APPLICATION OF THE FEDERAL 
BUREAU OF INVESTIGATION FOR AN ORDER 
REQUIRING THEPRODUCTI^^j^NGTB^ 
THINGS FROM 



DOCKET NO. BR 09-06 



ORDER 
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On this Coxirt issued a Supplemental Order in Docket No, PR/TT^^H 

that addressed several issues. Among other things, the Supplemental Order noted the 

government’s recent disclosure that the unminimized results of authorized queries of PRyiT 
metadata collected by the National Security Agency (NSA) pursuant to the Court’s order in 
Docket No. PR/TTHIIHand prior FISC orders had been shared with NSA 
analysts other than the limited number of analysts authorized to access such metadata. 
Supplemental Order at 1-2. Such sharing had not previously been disclosed to the Court. Id at 
2. The ^^^^^upplemental Order also noted the government’s disclosure of an inaccuracy 
regarding the number of PR/TT-derived reports described in paragraph 14 of the declaration 
attached as Exhibit A to the application in Docket No, PR/TT^^|, Id. at 3. 

The Court directed the government to submit, within 20 days, a declaration correcting the 
inaccuracy regarding the number of reports and to provide a complete and “updated description 
of NSA’s dissemination practices.” ^^^^^upplemental Order at 3-4. The Court further 
ordered that it would allow NSA, for a period of 20 days, to continue to share the unminimized 
results of authorized queries of the PR/TT metadata with NSA analysts other than the limited 
number of analysts authorized to access such metadata, but that such sharing was not to continue 
beyond the 20-day period unless the government first satisfied the Court, by written submission, 
that such sharing is necessary and appropriate on an ongoing basis. |d. at 4. 

On the United States filed the Government’s Response to the Court’s 
Supplemental Order Entered On in Docket No. PR/TT 

Response”), and the supporting Declaration Chief, Special Foreign 

Intelligence Surveillance Act Oversight and Processing, Oversight and Compliance, Signals 
Intelligence Directorate, NSA (“^^^^^^HDeclaration”). The government asserted in its 
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Ifilings that “the ability of PR/TT-cleared analysts to share unminimized query results 
with non-PR/TT-cleared analysts is critical to the success of the NSA’s counterteiTorism 
mission.” ^^^^J^^Declaration at 8. The government explained that while “[l]ess than ten 
percent of NSA’s analysts responsible for tracking and reporting foreign intelligence on 
counterterrorism matters generally may queiy the PR/TT metadata,” NSA’s “collective 
expertise” in the targeted foreign powers “resides in more than ^^^^^^^intelligence 
analysts” assigned not only to “NSA’s Counterten*orism Analytic Enterprise,” but also to “other 
NSA organizations and product lines.” Id. at 7-8. Further, the govenunent asserted that “[e]ach 
of the NSA’s ^^roduct lines has some role in protecting the homeland from terrorists.” Id, at 
8. Accordingly, the government has asked the Court to allow NSA to continue to share the 
results of authorized queries of the PR/TT metadata with analysts other than the limited number 



who are permitted to perform queries. S^ 



[Response at 9. 



On 



the United States submitted the Government’s Response to the Court’s 



Supplemental Order Entered on ^ 
Corrective Declaration 



I, in Docket No. PR/' 



Requesting a 



Response”), and the supporting Declaration of I 



Chief, Special Foreign Intelligence Surveillance Act Oversight and Processing, Oversight and 



Compliance, Signals Intelligence Directorate, NSA (“I 



iDeclaration”). In those 



filings, the government explained that thejj^Hreports described in the declaration filed in 



support of the government’s application in Docket No. PR/' 



TT^I 



included only reports 



prepared by PR/TT-cleared analysts; however, that description did not include one additional 



report that was prepared by a non-PR/TT analyst. 



)eclaration at 2-3. 



Accordingly, the government asserted that “^Hreports were produced and disseminated from 



inception of the PR/TT to 



” Id. at 3. 
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Unfortunately, the government’s responses to the Court’ s^^^Jsupplemental Order 
also raise two additional compliance issues, one which implicates not only the Court’s orders 
authorizing the collection of PR7TT metadata, but also its orders in the related bulk business 
records collection, which was last renewed by the Court in Docket No. BR 09-06. First, the 
government disclosed in its ^^^^filings in Docket No. PR/TT ^^|that NSA has generally 
failed to adhere to the special dissemination restrictions originally proposed by the govenunent, 
repeatedly relied upon by the Court in authorizing the collection of the PR/TT metadata, and 
incorporated into the Court’s orders as binding on NSA. See^^^| 
Response at 2. The Court’s current order, which is in pertinent part substantively identical to 



prior orders, provides that: 

The NSA shall treat information derived from queries of the metadata in 
accordance with United States Signals Intelligence Directiv^^^USSID 1 8) 
(Attachment D to the application in docket number PR/TT and shall apply 

USSID 18 to minimize infoimatioi^oncernin^NS^erspir^m^ from the 
pen registers and trap and trace^^^^^^^^^^^^^l Additionally, prior to 
disseminating any U.S. person information outside of the NSA, the Chief of 
Information Sharing Services in NSA’s Signals Intelligence Directorate shall 
determine that the information is related to counterterrorism information and is 
necessarj' to understand the counterterrorism information or to assess its 
importance. 

Docket No. PR/TT No.|^| Primary Order at 12..’ In its^^^Jsubmissions, however, the 
government disclosed that “the NSA has generally permitted the dissemination of U.S. person 
identities derived from the metadata acquired pursuant to the Court’s orders in this matter ... in 



accordance with [USSID 1 8] rather than specifically requiring that the narrower dissemination 



' Before September^^B, the Court’s orders designated the “Chief of Customer 
Response” in the NSA’s Signals Intelligence Directorate as the official responsible for 
determining whether information proposed for (^^nination had the necessary connectini^^ 
counterterrorism. See, e.g.. Docket No. PR/TT Order at 16; Docket No. PR/TT^^^|at 
10 . 
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provision set forth in the Coxirt’s orders in this matter be strictly adhered to,” ^^^HResponse 
at 2; see also ^^^^^^Declaration at 3-5. 

The Court understands the government’s disclosure to mean that NS A likely has 
disseminated U.S. person information derived from the PR/TT metadata outside NSA without a 
prior determination by the NSA official designated in the Court’s orders that the information is 
related to counterterrorism information and is necessary to understand the counterterrorism 
information or to assess its importance. S^ ^^^Hlesponse at 2. According to the 



government, the Department of Justice instructed NSA only to disseminate 

U.S. person information derived from the PR/TT metadata outside NSA after the designated 
official has made the required determination. Id. The government further stated that it is 
investigating the niatter. Id. at 2-3. 

Second, the government referred in its submissions to a dissemination-related 

problem that was first brought to the Court’s attention in a “preliminary notice of compliance 
incident filed with the Court on |^m||^^p3eclaration at 3 n.l. In the 

lotice - and in a separate notice filed contemporaneously in Docket No. BR 09-06 - the 
government informed the Court that the unminimized results of some queries of metadata 
collected in both matters had been “uploaded [by NSA] into a database to which other 
intelligence agencies . , . had access.” Preliminary Notice of Compliance Incident filed 

in Docket No. PR/TT^^| at 2; Preliminary Notice of Compliance Incident filed June 16, 
2009, in Docket No. BR 09-06 at 2. Providing such access, the government explained, may have 
resulted in the dissemination of U.S. person information in violation of USSID 18 and the more 
restrictive restrictions on dissemination proposed by the government and adopted by the Court in 
its current and prior orders in both of the above-captioned matters. Preliminary Notice of 
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Compliance Incident in Docket No. PR/TT^^| at 2; Preliminary Notice of 

Compliance Incident filed June 16, 2009, in Docket No. BR 09-06 at 2. The government 
explained that, in the PR/TT matter, any such disseminations would have been in addition to the 
^|reports that are described by the government in the ^^^^ubmissions. 

Declaration at 3 n. 1 . The govermnent asserts that NS A teiminated access by outside agencies to 
the database at issue and that it is still investigating the matter. Preliminaiy 

Notice of Compliance Incident filed June 16, 2009, in Docket No. BR 09-06 at 2; Preliminary . 
Notice of Compliance Incident filed^^^^^^^| in Docket No. PR/TT at 2. 

Based upon the information provided by the government in its recent submissions, the 
Court has concluded that NSA’s sharing of authorized queries of the PR/TT metadata with 
analysts other than the limited number authorized to access the metadata is not the principal 
concern presented. Indeed, according to the government, only one of theUreports containing 
PR/TT metadata and disseminated outside NSA was prepared by a non-cleared analyst. The 
Court is gravely concerned, however, that NSA analysts, cleared and otherwise, have generally 
not adhered to the dissemination restrictions proposed by the government, repeatedly relied upon 
by the Court in authorizing the collection of the PR/TT metadata, and incorporated into the 
Court’s orders in this matter^^^^^^^^^^^s binding on NSA. Given the apparent 
widespread disregard of these restrictions, it seems clear that NSA’s Office of General Counsel 
has failed to satisfy its obligation to ensure that all analysts with access to information derived 
from the PR/TT metadata “receive appropriate training and guidance regarding the querying 
standard set out in paragraph c. above, as well as other procedures and restrictions regarding the 
retrieval, storage, and dissemination of such information .” Docket No. PR/TT^^| Order at 1 1 
(emphasis added). The Court is also seriously concerned regarding NSA’s placement of 
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unminimized metadata from both the above-captioned matters into databases accessible by 
outside agencies, which, as the government has aclcnowledged, violates not only the Court’s 
orders, but also NSA’s minimization and dissemination procedures set forth in USSID 18. 

Accordingly, it is hereby ORDERED that; 

1 . With regard to Docket No. PR/TT NS A may share the results of authorized 
queries of the PR/TT metadata with NS A analysts other than the limited number of analysts who 
are authorized to access the metadata, provided, however, that any NS A analyst receiving such 
query results in any form has first received appropriate and adequate training and guidance 
regarding all rules and restrictions governing the use, storage, and dissemination of such 
information; 

2. With regard to Docket Nos. PR/TT^^|and BR 09-06, the government shall, by 

5; 00 p.m. each Friday, commencing on file with the Court a report listing each 

instance during the seven-day period ending the previous Friday in which NSA has shared, in any 
form, information obtained or derived from the PR/TT or BR metadata collections with anyone 
outside NSA, For each such instance, the government shall specify the date on which the 
information was shared, the recipient of the information, and the form in which the information 
was communicated (e,g.. written report, email, oral communication, etc.). For each such instance 
in which U.S. person information has been shared, the Chief of Information Sharing of NSA’s 
Signals Intelligence Directorate shall certify that such official determined, prior to dissemination, 
the information to be related to counterterrorism information and necessary to understand the 
counterten’orism information or to assess its importance; 

3. With regard to Docket Nos. PR/TT ^^^and BR 09-06, the government shall 

^ If Friday is a holiday, the report shall be submitted on the next business day, 
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include, in its submissions regarding the results of the end-to-end reviews, a full explanation of 
why the government has permitted the dissemination outside NSA of U.S. person infomation 
without regard to whether such dissemination complied with the clear and acknowledged 
requirements for sharing U.S. person information derived from the metadata collected pursuant 
to the Court’s orders. 

IT IS SO ORDERED this 



Judge, United States Foreign 
Intelligence Surveillance Court 




Clerk 

FISC, certify that this document 
is a true and correctj 
the orlglrial.r 
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UMTED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, D.C, 



DOCKET NO. PR7 



SUPPLEMENTAL ORDER 

in the above-captioned docket, the Court ordered the National Security 
Agency (“NSA”) to cease using the “master list described in the 

government’s Preliminary Notice of Conlpliance Incident filed on within 20 days 

unless the government showed cause, in writing, why it is necessary and appropriate for the NSA 
to continue to use the list. ^^^|supplemental Order at 4. In addition, the Court ordered the 
government to explain, in writing, why any ongoing use of PR/TT metadata collected uhder the 
authority of orders in this matter (“PR/TT metadata”) in connection with deleting information 
associated with is consistent with this Court’s orders and otherwise 

appropriate. Id. 
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The Court has reviewed the Government’s Response to the Court’s Supplemental Order, 
on the of Chief, 

Special Foreign Intelligence Surveillance Act Oversight and Processing, Oversight and 
Compliance, Signals Intelligence Directorate, The National Security Agency, filed on the same 
date (“^^^H^^^Declaration”). 

As the government has acknowledged, its practices with regard to the creation and use of 
defeat lists for selectors deviated, at least in part, from the procedures governing the 

handling of PR/TT metadata. It is important to note that the procedures at issue were devised by 
the government and incorporated into the Court’s orders as binding upon the NS A at the 
government’s suggestion. Had the government initially proposed procedures pennitting defeat 
list practices such as those described in the Response and the^^^^^^|Declaration, 

the Court likely would have found them reasonable and would have incorporated such 
procedui'es in its orders. 

In any event, the Court finds that the continuation of the defeat list practices is reasonable 
and appropriate. Therefore, subject to further consideration following the submission of the 
government’s report on its end-to-end review, it is 

HEREBY ORDERED that the restrictions imposed by the Court in paragraph 3 of its 
^^^|supplemental Order, are hereby lifted and, as the government requests, NSA is 
authorized to: 

o Continue to use the existing “master defeat list” for metadata reduction and management 
in its contact-chaining repositories, including those repositories containing 



TOP SECRET//COMINT//NOFORN 



- 2 - 









TOP SECRET//COIVnNT//NOFORN 



6 



This 



PR/TT metadata and those containing non-PR/TT metadata; 

Add to the “master defeat list” ^^^^^Hidentifiers discovered by NSA techirical 
personnel through chain summary building and management processes, as described in 
paragraphs 6-8 of the^^^^mDeclaration; and 

Add to tlie “master defeat list” ^^^^^^^|identifiers discovered by NSA analysts 
reviewing the results of authorized queries of the PR/TT metadata. 




Judge, United States Foreign 
Intelligence Surveillance Court 



the 
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